From 19d59a4d96858a94b8f939785e3d5855835a7b99 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Thu, 18 Jun 2026 09:12:47 +0200 Subject: [PATCH] Return not found for OIDC org access errors Map membership, profile, and inactive-user failures from OpenOIDCChildSessionForOrganization to a generic 404 instead of 500 so org-scoped OIDC callbacks do not reveal tenant access details. Signed-off-by: Bryan Frimin --- pkg/server/api/connect/v1/oidc_handler.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/pkg/server/api/connect/v1/oidc_handler.go b/pkg/server/api/connect/v1/oidc_handler.go index 51098ad62..6130d4f29 100644 --- a/pkg/server/api/connect/v1/oidc_handler.go +++ b/pkg/server/api/connect/v1/oidc_handler.go @@ -171,6 +171,24 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) { if organizationID != nil { _, _, err = h.iam.SessionService.OpenOIDCChildSessionForOrganization(ctx, rootSession.ID, *organizationID) if err != nil { + if _, ok := errors.AsType[*iam.ErrMembershipNotFound](err); ok { + httpserver.RenderError(w, http.StatusNotFound, errors.New("not found")) + + return + } + + if _, ok := errors.AsType[*iam.ErrProfileNotFound](err); ok { + httpserver.RenderError(w, http.StatusNotFound, errors.New("not found")) + + return + } + + if _, ok := errors.AsType[*iam.ErrUserInactive](err); ok { + httpserver.RenderError(w, http.StatusNotFound, errors.New("not found")) + + return + } + h.logger.ErrorCtx(ctx, "cannot open OIDC child session", log.Error(err)) httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error"))